CVE-2025-38624

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> PCI: pnv_php: Clean up allocated IRQs on unplug<br /> <br /> When the root of a nested PCIe bridge configuration is unplugged, the<br /> pnv_php driver leaked the allocated IRQ resources for the child bridges&amp;#39;<br /> hotplug event notifications, resulting in a panic.<br /> <br /> Fix this by walking all child buses and deallocating all its IRQ resources<br /> before calling pci_hp_remove_devices().<br /> <br /> Also modify the lifetime of the workqueue at struct pnv_php_slot::wq so<br /> that it is only destroyed in pnv_php_free_slot(), instead of<br /> pnv_php_disable_irq(). This is required since pnv_php_disable_irq() will<br /> now be called by workers triggered by hot unplug interrupts, so the<br /> workqueue needs to stay allocated.<br /> <br /> The abridged kernel panic that occurs without this patch is as follows:<br /> <br /> WARNING: CPU: 0 PID: 687 at kernel/irq/msi.c:292 msi_device_data_release+0x6c/0x9c<br /> CPU: 0 UID: 0 PID: 687 Comm: bash Not tainted 6.14.0-rc5+ #2<br /> Call Trace:<br /> msi_device_data_release+0x34/0x9c (unreliable)<br /> release_nodes+0x64/0x13c<br /> devres_release_all+0xc0/0x140<br /> device_del+0x2d4/0x46c<br /> pci_destroy_dev+0x5c/0x194<br /> pci_hp_remove_devices+0x90/0x128<br /> pci_hp_remove_devices+0x44/0x128<br /> pnv_php_disable_slot+0x54/0xd4<br /> power_write_file+0xf8/0x18c<br /> pci_slot_attr_store+0x40/0x5c<br /> sysfs_kf_write+0x64/0x78<br /> kernfs_fop_write_iter+0x1b0/0x290<br /> vfs_write+0x3bc/0x50c<br /> ksys_write+0x84/0x140<br /> system_call_exception+0x124/0x230<br /> system_call_vectored_common+0x15c/0x2ec<br /> <br /> [bhelgaas: tidy comments]